[
https://issues.apache.org/jira/browse/JCRVLT-877?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rishabh Daim reassigned JCRVLT-877:
-----------------------------------
Assignee: Rishabh Daim (was: Konrad Windszus)
> Remote child named .vlt overwrites the working-copy control zip under vlt up
> --force
> ------------------------------------------------------------------------------------
>
> Key: JCRVLT-877
> URL: https://issues.apache.org/jira/browse/JCRVLT-877
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Rishabh Daim
> Priority: Major
> Fix For: 3.2.10, 4.3.0
>
>
> Package configuration files (config.xml) can name any Java class, and the
> software loads that class as soon as a package is opened, before permissions
> are checked. A crafted package could abuse this to run code on the server.
> The fix allows only approved filter types and blocks a syntax that reads
> class values directly. Built-in configurations don't use these features, so
> nothing shipped should break.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
